The vulnerability arises because the Spring Framework allows a safety guard bypass when the SpEL expression compiler is active and an expression is evaluated using SimpleEvaluationContext. A crafted SpEL expression supplied by an attacker can be compiled and executed within the host JVM, enabling arbitrary code execution. The impact is therefore a potential compromise of confidentiality, integrity, and availability of the affected application or underlying system.

Affected vendor: Spring Framework. Versions impacted include Spring Framework 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and all releases 5.2.25.RELEASE and earlier.

The CVSS score for this vulnerability is not available, and the EPSS indicates no data. The vulnerability is not listed in the CISA KEV catalog as of the latest information. The likely attack vector involves an attacker injecting a malicious SpEL expression into data that is evaluated within the application using SimpleEvaluationContext with the compiler enabled. If an attacker succeeds, the malicious code runs with the application's privileges, potentially achieving full system compromise. The likelihood of exploitation depends on whether vulnerable endpoints are exposed and whether the attacker can supply input.